淘东电商项目（69） -互联网安全架构设计（XSS攻击防御）

/**
 * description: 网关行为建造者
 * create by: YangLinWei
 * create time: 2020/5/20 9:09 上午
 */
public interface GatewayBuild {
  /**
   * 黑名单拦截
   */
  Boolean blackBlock(RequestContext ctx, String ipAddres, HttpServletResponse response);
  /**
   * 参数验证
   */
  Boolean toVerifyMap(RequestContext ctx, String ipAddres, HttpServletRequest request);
  /**
   * 参数过滤转义（防御XSS攻击）
   */
  Map<String, List<String>> filterParameters(HttpServletRequest request, RequestContext ctx);
}

@Override
public Map<String, List<String>> filterParameters(HttpServletRequest request, RequestContext ctx) {
    Map<String, List<String>> requestQueryParams = ctx.getRequestQueryParams();
    if (requestQueryParams == null) {
        requestQueryParams = new HashMap<>();
    }
    Enumeration em = request.getParameterNames();
    while (em.hasMoreElements()) {
        String name = (String) em.nextElement();
        String value = request.getParameter(name);
        ArrayList<String> arrayList = new ArrayList<>();
        // 将参数转化为html参数 防止xss攻击 < 转为&lt;
        arrayList.add(StringEscapeUtils.escapeHtml(value));
        requestQueryParams.put(name, arrayList);
        log.info(">>>>>>过滤参数name:{},arrayList:{}>>>>>>>", name, arrayList);
    }
    return requestQueryParams;
}

@Component
public class GatewayDirector {
    @Resource(name = "verificationBuild")
    private GatewayBuild gatewayBuild;
    public void direcot(RequestContext ctx, String ipAddres, HttpServletResponse response, HttpServletRequest request) {
        /**
         * 黑名单拦截
         */
        Boolean blackBlock = gatewayBuild.blackBlock(ctx, ipAddres, response);
        if (!blackBlock) {
            return;
        }
        /**
         * 参数验证
         */
        Boolean verifyMap = gatewayBuild.toVerifyMap(ctx, ipAddres, request);
        if (!verifyMap) {
            return;
        }
        /**
         * XSS攻击处理
         */
        Map<String, List<String>> filterParameters = gatewayBuild.filterParameters(request, ctx);
        if (filterParameters != null && filterParameters.size() > 0) {
            ctx.setRequestQueryParams(filterParameters);
        }
    }
}